Node.js Development Services for High-Throughput APIs and Real-Time Systems
Node.js is a server-side JavaScript runtime built on V8 and a non-blocking event loop, and it also executes TypeScript files directly, with no build step — a capability that became stable in v25.2.0. Mixcore Studio builds and maintains Node.js APIs, background services and real-time systems, and takes on rescue work for Node codebases that have drifted off a supported release line.
We have been shipping production software for more than 8 years, with a team of around 20 and more than 320 projects delivered. Most Node.js work reaching us now takes one of two shapes. Either a new service where throughput, integration and time-to-ship matter more than raw computation, or an existing application stuck on an end-of-life Node version, a deprecated bundler, or a framework release line that no longer receives security patches.
What changed in Node.js by August 2026
Node.js moves on a fixed release cadence, and the line you sit on determines how long you can defer an upgrade. As of August 2026 the picture is this.
- Node 24 "Krypton" is the Active LTS — LTS since 28 October 2025, entering maintenance on 20 October 2026, end of life 30 April 2028. This is our default for production.
- Node 26 is Current — released 5 May 2026, scheduled to enter LTS on 28 October 2026. A reasonable target for a new build that goes live after that date.
- Node 22 "Jod" is Maintenance LTS — end of life 30 April 2027. Anything still running on it needs an upgrade already in the plan, not in the backlog.
- Node 20 and earlier are end of life — Node 20 "Iron" reached end of life on 30 April 2026 and receives no further security patches. The tooling floor moved with it: Next.js 16 requires Node 20.9 or newer and dropped Node 18 entirely, and Vite 8 requires 20.19+ or 22.12+.
- ECMAScript 2026 was approved — the 17th edition of ECMA-262 was published by Ecma International in June 2026. It brings
Math.sumPrecise,Error.isError,RegExp.escape,Array.fromAsync, base64 conversion forUint8Arrayand iterator sequencing. Temporal and explicit resource management throughusingandawait using— which gives deterministic release of database connections, file handles and locks instead of hand-written try/finally blocks — are finished proposals slated for the 2027 edition, not this one.
TypeScript now runs on Node without a build step
Node strips types from .ts files and runs them. Type stripping has been unflagged by default since v23.6.0 and reached Stability 2, meaning stable, in v25.2.0. Deno and Bun do the same natively. GitHub's Octoverse 2025 report found TypeScript became the most-used language on GitHub for the first time, passing both Python and JavaScript, so this affects most new backend work rather than a niche.
The consequence is that the compiler's job narrowed to a CI type-checking gate. The caveats are specific and they catch teams out.
- Node erases types, it does not check them — it also ignores
tsconfig.jsoncompletely at runtime. If a type check does not run in CI, it does not run at all. - Only erasable syntax is supported — enums, runtime namespaces, parameter properties, import aliases and decorators all error out, and
.tsxis not supported. - Import rules tighten — the
typekeyword is mandatory on type-only imports and file extensions are mandatory in import specifiers. - Configure the project for it —
erasableSyntaxOnly,verbatimModuleSyntaxandrewriteRelativeImportExtensionskeep a codebase inside the subset Node will actually execute. - Checking itself got much faster — TypeScript 7.0, released 8 July 2026, is a native Go port of the compiler. The Microsoft TypeScript team reports 8 to 12 times faster full builds, and a full type check of the VS Code codebase falling from 125.7 seconds to 10.6 seconds. It ships no programmatic API until 7.1, so typescript-eslint and the Svelte, Vue and Astro template checkers still need TypeScript 6 alongside it.
The edge retreat put Node back at the centre
For several years the recommended target for a JavaScript backend was a constrained edge runtime. That era ended by consolidation rather than growth. Vercel now recommends migrating off the Edge runtime to the full Node.js runtime, with both running on Fluid compute, which allows concurrency inside a single function instance. Next.js 16 replaced middleware.ts with proxy.ts running on Node, and Next.js 16.3 dropped support for export const runtime = 'edge' outright.
The practical effect is that the constraints teams accepted in order to run at the edge, such as missing Node APIs, no long-lived connections and awkward database access, are no longer the price of entry. Cloudflare Workers remains genuinely isolate-native and is still the right answer for some read-heavy, geographically spread workloads. But edge-by-default is over, and a warm Node process is once again the mainstream server. Vercel's own Next.js 16.3 release post reports up to 22% more requests handled under load after replacing web streams with native Node.js streams in the App Router render layer.
Server-rendered with client-side navigation layered on top is now the mainstream architecture for content, marketing and commerce, and it is also the shape that passes Core Web Vitals, which Google still assesses at LCP under 2.5 seconds, INP under 200 milliseconds and CLS under 0.1 at the 75th percentile of real-user data.
What we build on Node.js
- HTTP and JSON APIs — Fastify, Hono or Express behind an OpenAPI contract, with validation at the boundary rather than scattered through handlers.
- Real-time systems — WebSocket and Server-Sent Events services for chat, live dashboards, collaborative editing and streamed LLM output, where holding many mostly-idle connections cheaply is exactly what an event loop is good at.
- Integration and workflow services — queue consumers, webhook receivers, scheduled jobs and connectors into CRM, ERP and payment systems, with idempotency and retry designed in rather than bolted on.
- Full-stack applications — SvelteKit, Next.js or Astro running on a Node server, server-rendered by default.
- Backend-for-frontend layers — a thin Node tier in front of existing .NET, Java or PHP systems, so a new interface can ship without waiting on a core rewrite.
- Runtime and toolchain upgrades — moving applications off end-of-life Node lines, off webpack, onto Vite 8 with Rolldown or Turbopack, and onto oxlint or Biome where ESLint and Prettier had become the slow step.
Build tooling went native in 2026 and the difference is large enough to plan around. The Vite team reports Rolldown, the single Rust bundler that became Vite 8's default on 12 March 2026, delivering up to 10 to 30 times faster builds, with Linear's build falling from 46 seconds to 6 seconds and Mercedes-Benz.io reporting a 38% reduction. Turbopack is the default in Next.js 16. If your pipeline is slow today, that is now a fixable cost rather than a fact of the platform.
When Node.js is the wrong choice
Node is a poor fit for CPU-bound work. Video transcoding, large numerical workloads, heavy image processing and cryptographic batch jobs all monopolise a single-threaded event loop, and while worker threads and native addons exist, Go, Rust or .NET will usually give you a simpler system and better hardware utilisation. If the bottleneck is computation rather than waiting on I/O, Node is the wrong shape and we will say so before the contract, not after.
The second case is a platform migration dressed up as a version problem. .NET 8 and .NET 9 both reach end of support on 10 November 2026, which is forcing a large installed base to move. The funded path there is .NET 10, which is LTS and supported through November 2028, not a rewrite in Node. Swapping platforms to solve a scheduled upgrade converts a known cost into an unknown one. We do ASP.NET Core work as well, so this is not advice against our own interest.
The third is subtler. Running TypeScript directly on Node is not a reason to stop type checking. Teams that delete the compile step and never add a CI gate ship a codebase with type annotations that nothing verifies, which is worse than plain JavaScript because it reads as safe.
Security, release lines and the cost of staying current
Framework patch cadence became a procurement question in December 2025, when React2Shell (CVE-2025-55182) was disclosed on 3 December 2025. It was an unauthenticated remote code execution flaw scored CVSS 10.0, caused by deserialization in the React Server Components Flight protocol. Fixes landed in React 19.0.1, 19.1.2 and 19.2.1, with accompanying patch releases across the supported Next.js lines.
Vercel's response was to formalise a Next.js Security Release Program on 13 July 2026, with roughly monthly pre-announced security releases carrying advance notice of the timeline and the highest anticipated severity. Its first scheduled release, in July 2026, shipped patches for the Next.js 16.2 and 15.5 lines. Vercel cited LLM-assisted vulnerability research as a driver, pointing to Mozilla disclosing 271 issues in a single Firefox release. Disclosure volume is going up on both sides of the fence.
What that means in practice for a Node project is unglamorous. Pin to a named LTS line for both the runtime and the framework, keep a written upgrade window rather than an intention, and make sure an emergency patch can be built, tested and deployed in hours. That last property is a function of test coverage and pipeline speed, not of goodwill.
The verification burden also shifted. The DORA 2025 State of AI-assisted Software Development report, based on around 5,000 technology professionals, finds 90% now use AI at work, and that AI adoption correlates positively with delivery throughput while still correlating negatively with delivery stability. The Stack Overflow 2025 Developer Survey of nearly 49,000 developers finds 84% using or planning to use AI tools, only 3% highly trusting the accuracy of the output, and 66% naming AI solutions that are almost right, but not quite, as their top frustration. We treat senior review and automated verification as the load-bearing part of delivery, and we are direct about which parts of a codebase were AI-assisted and how they were checked.
Our expertise
- API and service architecture
- Real-time and streaming
- TypeScript-first codebases
- Data layer and integrations
- Performance and observability
- Upgrades and security patching
Frequently asked questions
Which Node.js version should we run in production in 2026?
Node 24 "Krypton" is the Active LTS line and the safe default. It has been LTS since 28 October 2025, enters maintenance on 20 October 2026 and is supported to 30 April 2028. Node 26 became Current on 5 May 2026 and enters LTS on 28 October 2026, so it suits a build going live after that date. Node 22 is Maintenance LTS with end of life on 30 April 2027, and Node 20 and earlier reached end of life on 30 April 2026, so anything still on those lines is no longer receiving security patches.
Do we still need a TypeScript build step to run Node.js?
Not to run it. Node strips types and executes .ts files directly, unflagged since v23.6.0 and stable since v25.2.0. You do still need a type check, because Node erases types without verifying them and ignores tsconfig.json at runtime, so tsc becomes a CI gate rather than a build stage. Only erasable syntax works, which rules out enums, runtime namespaces, parameter properties, import aliases, decorators and .tsx files.
Is Node.js fast enough for a high-traffic application?
For I/O-bound workloads, which covers most APIs, real-time services and web applications, yes. The event loop is efficient precisely because most of its time is spent waiting on databases, queues and third-party services rather than computing. Vercel measured up to 22% more requests handled under load in Next.js 16.3 simply by switching the render layer to native Node.js streams. For CPU-bound work such as transcoding or heavy numerical processing, Node is the wrong tool and Go, Rust or .NET will serve you better.
Should we use Bun or Deno instead of Node.js?
Both are credible and both run TypeScript natively. Bun 1.3.14, released 13 May 2026, added built-in image processing plus experimental HTTP/2 and HTTP/3 in fetch and HTTP/3 over QUIC in Bun.serve, alongside its unified SQL API and built-in Redis client. Deno reached 2.9.5 in August 2026. We use them where their built-ins genuinely remove dependencies. For long-lived production systems Node remains our default, because the LTS calendar is predictable, hosting support is universal and the ecosystem compatibility surface is the largest.
How do you handle framework and runtime security patches?
We pin to named LTS lines for both the runtime and the framework, and we keep a written upgrade window rather than an intention. React2Shell (CVE-2025-55182), a CVSS 10.0 unauthenticated remote code execution flaw in the React Server Components Flight protocol, was disclosed on 3 December 2025 and reset expectations across the industry. Vercel now runs a formal Next.js Security Release Program with roughly monthly pre-announced releases. The property that actually protects you is being able to build, test and deploy an emergency patch in hours, which depends on test coverage and pipeline speed.
Contacts
We are always happy to talk with you.
Feel free to contact us in any suitable way
Request a quote
Let's discuss your project!
Please, provide us with a brief description of what you
already have and what you are going to achieve.
Mail us contact@brainiacminds.com